Brotli decoder flaw evolves into HTTP2Shell, expanding remote code execution across stacks

Overview

Updated 1 hour ago

A single memory bug went from an unlabeled commit in Google's Brotli library in February to a critical vulnerability called HTTP2Shell by late October. Node.js patched it on October 21; three days later researchers had traced it across Python HTTP clients, Bun, curl, and Express middleware that decode Brotli by default.

The bug, CVE-2026-111497, is an out-of-bounds write in Brotli decoder versions 1.0.3 through 1.2.0, scored 9.2 critical on the CVSS 4.0 scale. Any process that decompresses attacker-controlled Brotli data can crash, leak memory, or run attacker code. No in-the-wild attacks are confirmed, but patches are still rolling out and bundled copies in.NET, PHP, Ruby, DuckDB and ClickHouse lack fixes.

Why it matters

Because HTTP clients and server middleware decode Brotli by default, unpatched web-facing stacks face pre-auth remote code execution from a single compressed request.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

9.2 / 10

CVSS 4.0 severity

Critical severity rating for the out-of-bounds write in Brotli 1.0.3–1.2.0.

Confirmed attacks in the wild

No real-world exploitation confirmed as of October 24, 2026; the flaw is not in CISA's Known Exploited Vulnerabilities catalog.

10+

Software families with exposed Brotli paths

Node.js, Python libraries, Bun, curl, .NET, PHP, Ruby, DuckDB, ClickHouse, and Envoy decode Brotli or bundle the vulnerable library.

3 of 4

Node.js release lines patched

Node.js 22.23.4, 24.22.1 and 26.12.1 carry fixes; Node.js 20 and older receive no patch.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

People Involved

Matteo Collina

Node.js maintainer, co-author of the October 21 fix

Active maintainer

Antoine du Hamel

Node.js contributor, co-author of the October 21 fix

Active contributor

Khai Tran

Security researcher at OpenAI Codex Security, reported the vulnerability

Credited in the Node.js security advisory

Sylvie Mayer

Security researcher at OpenAI Codex Security, reported the vulnerability

Credited in the Node.js security advisory

Organizations Involved

Google Brotli Team

Open-source library maintainer

Vendor of the vulnerable decoder; shipped fixes

Owns the Brotli decoder library at the center of the vulnerability.

Node.js (OpenJS Foundation)

Open-source runtime project

First major vendor to ship a fix

Open-source JavaScript runtime whose bundled Brotli decoder was the first disclosed exposure.

OpenAI Codex Security

Security research team

Disclosed the vulnerability

OpenAI's security research team that reported the flaw to Node.js.

Aikido Security

Application security vendor

Published impact research, renamed the threat HTTP2Shell

Application security firm that traced the bug's blast radius across Python and renamed it HTTP2Shell.

Imperva

Web security vendor

Published code-execution research

Published research reproducing remote code execution through Express 5 and body-parser 2.x.

Vercel

Edge computing platform

Deployed mitigation rules on disclosure day

Edge platform that rolled out WAF rules to reject Brotli request bodies at the proxy layer.

Timeline

February 2026 October 2026

6 events Latest: Today

Tap a bar to jump to that date

October 2026
Bun adopts HTTP2Shell name; bundled copies still awaiting fixes
Today Update

Bun's advisory uses HTTP2Shell. Bundled copies of the vulnerable decoder in.NET, PHP, Ruby, DuckDB and ClickHouse still lack patches.
Today
brotlicffi fix ships; threat renamed HTTP2Shell
Research

Python brotlicffi 1.2.1.0 reaches PyPI. Aikido publishes research showing the bug is a shared-library issue and renames the threat HTTP2Shell. GovCERT.CZ issues a warning.
Yesterday
Bun patches; CVE record and PoCs publish
Security Release

Bun 1.4.4 ships the fix. CVE-2026-111497 and GitHub advisory GHSA-9v8h-qqgm-4m35 publish. Imperva reproduces code execution; PoC repositories multiply on GitHub.
2 days ago
Node.js ships Brotli fixes; first Node2Shell posts appear
Security Release

Node.js releases 22.23.4, 24.22.1 and 26.12.1, rating the Brotli bug high. Coverage that afternoon dubs it Node2Shell.
3 days ago • 10:38 UTC
Google publishes fixed Brotli releases; Vercel deploys WAF rules
Security Release

Google ships Brotli 1.0.10, 1.1.1 and 1.2.1. Vercel announces WAF rules rejecting Brotli request bodies at the edge.
3 days ago • 19:27 UTC
February 2026
Root-cause fix lands in Brotli source
Fix

Google merges commit 0ed4268 in the Brotli repository without a security label, unknowingly fixing a bug that would later be rated critical.
February 2026

Scenarios

Patch wave completes; HTTP2Shell fades without a major breach

Likely Resolves by End of 2026

Discussed by: Security observers and Hacker News commenters arguing server-side exposure is limited because most platforms do not enable Brotli decoding by default

Vendors ship patched Brotli across Node.js, Python, Bun, curl,.NET, PHP, Ruby, DuckDB and ClickHouse by early 2027. With no confirmed in-the-wild attacks, the vulnerability becomes a footnote similar to many other shared-library flaws that were patched before widespread exploitation. The HN thread's most-cited counterargument is that server stacks only become reachable when explicit middleware like Express 5 enables body inflation by default.

First confirmed in-the-wild attack lands before patch coverage completes

Possible Resolves by End of 2026

Discussed by: Imperva and Strobes research teams, both of whom demonstrated code execution in lab settings

An attacker exploits the decoder before a long-tail vendor ships a fix, or through an exposed Express 5 or body-parser endpoint that inflates Brotli request bodies by default. Public PoC repositories on GitHub lower the barrier to entry. The incident surfaces via CISA's KEV catalog or a vendor advisory within months.

Bundled-copy vendors lag; attack hits an unpatched niche tool

Possible Resolves by Q1 2027

Discussed by: Strobes blog post noting bundled copies in DuckDB, ClickHouse, PHP and Ruby still awaiting fixes

A niche database or archive tool that bundles the vulnerable decoder ships without a patch past the major-vendor wave. An attacker targets it directly or through a workflow that feeds it compressed data, and the incident traces back to the unpatched Brotli copy. The long tail mirrors Log4Shell's pattern of months-long patch gaps across embedded copies.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

April 2014

Heartbleed (2014)

OpenSSL's TLS heartbeat extension lacked a bounds check, letting any remote attacker read up to 64 KB of server memory per request. Most of the world's encrypted servers ran the flawed code, exposing passwords, session keys and private data.

Then

A frantic patch scramble followed; many systems stayed vulnerable for months because appliances and embedded devices could not update quickly.

Now

The incident pushed the industry toward coordinated disclosure and renewed calls for memory-safe rewrites of critical libraries.

Why this matters now

Both Heartbleed and HTTP2Shell are bugs in a single embedded library with an enormous blast radius, requiring coordinated patches across thousands of products.

December 2021

Log4Shell RCE (2021)

Apache Log4j 2's log message formatting allowed Java Naming and Directory Interface (JNDI) lookups that ran attacker-controlled code. The logging library sat inside millions of Java applications, and the first patch was bypassed within days.

Then

Vendors scrambled to catalog affected products; researchers found new attack surfaces for months afterward.

Now

Log4Shell became the reference case for supply chain risk in embedded libraries, with the U.S. government ordering federal agencies to patch immediately.

Why this matters now

HTTP2Shell follows the same arc: RCE in a library everyone embeds, a growing patch catalog, and a long tail of bundled copies that lag behind the major-vendor fixes.